A direct firewall rule survives live reload while the nftables backend reorders chains on restart during a failover rehearsal

The runtime policy looked right and the boot-time chain order changed how packets were really evaluated. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.